NAME
Dancer::Plugin::Bcrypt - Bcrypt interface for Dancer
VERSION
version 0.3.0
DESCRIPTION
This plugin is a simple interface to the bcrypt algorithm allowing web apps created by dancer to easily store passwords in a secure way.
It generates a crypographically strong salt for each password, uses the very strong bcrypts algorithm to hash the password - and does these in a configurable and portable manner.
BACKGROUND
See http://codahale.com/how-to-safely-store-a-password/
To safely store passwords in the modern era, you should use bcrypt. It's that simple
MD5, SHA and their ilk are general purpose hash functions, designed for speed.
An average server can calculate the MD5 hash of every 6 character, alphanumeric password in about 40 seconds. The beefiest boxen can do the same in ONE second
Bcrypt is an adaptive password hashing algorithm. It uses a work factor to determine how SLOWLY it hashes a password. This work factor can be increased to keep up with the ever increasing power of computers.
KEYWORDS
bcrypt
The only keyword provided by this plugin.
Pass it a plaintext password, and it will return a string suitable for storage, using the settings specified in the app config.
This string contains the bcrypted hash, work factor used, and the salt used to generate the hash, delimited by a $.
my $hash = bcrypt($plaintext);
Pass a plaintext password and a stored bcrypted string, it will return a hash of the plaintext password using the work factor and salt from the stored hash.
You would use this to verify that a password provided by a user matches the hash you have stored in the database.
my $hash = bcrypt($plaintext, $stored_hash);
USAGE
package MyWebService;
use Dancer;
use Dancer::Plugin::Bcrypt;
get '/' sub => {
# Generate a new hashed password - suitable for storing in a DB.
my $hash = bcrypt( param('password') );
# [...]
# Validate password provided by user against stored hash.
my $stored_hash = ''; # [...] retreive password from the DB.
my $hash = bcrypt(param('password'), $stored_hash);
if ($hash == $stored_hash) {
# Password matched!
}
};
CONFIGURATION
You can set the work factor and the random-ness of the salt in your config.yml
plugins:
bcrypt:
work_factor: 8
random_factor: strong
SEE ALSO
http://perldancer.org/
http://codahale.com/how-to-safely-store-a-password
http://search.cpan.org/dist/Crypt-Random-Source/
http://search.cpan.org/dist/Crypt-Eksblowfish/
AUTHOR
James Aitken
COPYRIGHT AND LICENSE
This software is copyright (c) 2011 by James Aitken.
This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.